Orphaned branch feat/qbo-mcp-onesie: 1,774 lines of QuickBooks MCP (server/client/adapter/crypto/audit + tests) pushed since 2026-07-06 with no PR and no issue

[olegbrok]

Found during the worktree-sprawl audit (task #498). Not a bug — untracked work that is one step from being forgotten.

What exists

Branch feat/qbo-mcp-onesie, single commit 95773c8 "wip(qbo-mcp): pinky_qbo package skeleton + allowlist tests + spec (Onesie QuickBooks MCP)", dated 2026-07-06. Pushed to origin — verified via git ls-remote, same SHA — so nothing is at risk of loss.

1,774 insertions across 13 files:

specs/qbo-mcp-onesie.md               150
src/pinky_qbo/client.py               344
src/pinky_qbo/server.py               293
src/pinky_qbo/adapters/quickbooks.py  231
src/pinky_qbo/store.py                126
src/pinky_qbo/adapters/base.py        104
src/pinky_qbo/__main__.py              97
src/pinky_qbo/audit.py                 95
src/pinky_qbo/crypto.py                56
tests/test_pinky_qbo_allowlist.py     274
pyproject.toml                          3

That is a complete MCP package skeleton — server, client, a QuickBooks adapter behind a base-adapter interface, credential crypto, a store, an audit trail, and an allowlist test suite — plus a written spec.

Why it's worth a ticket

No PR was ever opened, and there is no issue referencing it. gh issue list across all states matches nothing for qbo/quickbooks. So this work is:

• invisible to anyone reading the issue tracker or the PR list,
• unreviewed — including crypto.py and audit.py, which are exactly the files that should not land unreviewed,
• nearly a month cold, against a codebase that has moved considerably (SQLite thread-safety batches, scheduler delivery-confirmation, ACP connector all landed since).

It survived only because its worktree was still on disk. A pushed branch with no PR is the quietest way for real work to disappear — nothing errors, nothing is lost, and nobody ever looks at it again. I nearly deleted the worktree as "no PR found, probably scratch."

Asks

1. Decide whether QuickBooks-for-onesie is still wanted. If yes, this is a substantial head start and should get a draft PR so it is tracked and reviewable. If no, say so here and the branch can be deleted deliberately rather than rotting.
2. Either way, do not delete the worktree /Users/oleg/PinkyBot-qbo-mcp until that decision is made. It is excluded from the design: response_callback signature divergence between StreamingSession and TmuxSession #498 cleanup.
3. If it proceeds: it needs rebasing onto current main before review, and crypto.py / audit.py / the allowlist tests deserve the same scrutiny any credential-handling code gets.

Process note

The audit found 43 worktrees: 29 with merged PRs and clean trees (reclaimable), 3 with open PRs, and this one — the only case where "no PR" meant "real work nobody tracked" rather than "abandoned scratch." Worth remembering that the anomaly in a cleanup sweep is the thing worth reading, not the thing to batch past.

---

🤖 Filed by Barsik